官方文档:REDHAT-USING FIREWALLS
安装
# 安装防火墙
yum install firewalld
# 查看版本
firewall-cmd --version
# 查看帮助
firewall-cmd --help
启动，自启动
# 开启，关闭，重启防火墙
systemctl start firewalld
systemctl stop firewalld
systemctl restart firewalld
# 设置/禁止开机启动
systemctl enable firewalld
systemctl disable firewalld
查看状态与端口设置
# 查看防火墙状态，以下两条指令均可
systemctl status firewalld
firewall-cmd --state
# 临时开放端口/关闭端口，无需reload立即生效
firewall-cmd --zone=public --add-port=1225/tcp
firewall-cmd --zone=public --remove-port=1225/tcp
# 永久开放/关闭端口，需更新防火墙规则方可生效，
firewall-cmd --permanent --zone=public --add-port=1225/tcp
firewall-cmd --permanent --zone=public --remove-port=1225/tcp
# 更新防火墙规则
firewall-cmd --reload
# 查看开放端口列表
firewall-cmd --list-ports
# 查看
firewall-cmd --list-all
public
target: default
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client ss ssh
ports: 2012/tcp 1225/tcp 80/tcp 8080/tcp
protocols:
masquerade: no
forward-ports:
sourceports:
icmp-blocks:
rich rules:
# 列出系统上可用的所有服务
firewall-cmd --get-services
# 输出大概如下
RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client ceph ceph-mon dhcp dhcpv6 dhcpv6-client dns docker-registry dropbox-lansync freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imap imaps ipp ipp-client ipsec iscsi-target kadmin kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp smtps snmp snmptrap squid ss ssh synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
# 开启服务/关闭服务
firewall-cmd --add-service ftp
firewall-cmd --remove-service ftp
firewall-cmd --add-service ssh
firewall-cmd --remove-service ssh
# 查询服务的启用状态
firewall-cmd --query-service ftp
firewall-cmd --query-service ssh
# 列出系统服务或者用户创建的服务
ls /etc/firewalld/services/
# 增加新服务，在上述目录下生成新的文件
firewall-cmd --permanent --new-service=service-name
# 服务xml基本格式如下
<?xml version="1.0" encoding="utf-8"?>
<service>
<short>SS</short>
<description>Shadowsocks port
</description>
<port protocol="tcp" port="1225"/>
</service>
